Dependency graph produces SBOMs

[github-product-roadmap]

Summary

Developers can export their dependency graph as a Software Bill of Materials (SBOM), a formal, machine-readable inventory of their dependencies and associated information (versions, licenses, etc).

Intended Outcome

SBOMs are required for companies that provide software to the US federal government per Executive Order 14028. SBOMs also make auditing easier and helps companies comply with their organisation's regulatory and legal requirements.

How will it work?

Developers will be able to visit their repository's dependency graph page and export the current state of their dependency graph as a JSON file using an industry standard format like SPDX. Developers will also be able to retrieve the SBOM from their repository using an API.

[ankneis]

🚢 This has shipped to dotcom: https://github.blog/changelog/2023-03-28-generate-an-sbom-from-the-dependency-graph.

Leaving open to track for GHES release.

[ankneis]

🚢 This has shipped with GHES 3.9: https://docs.github.com/en/enterprise-server@3.9/admin/release-notes. Closing as complete.